3Com WX4400 3CRWX440095A, WXR100 3CRWXR10095A, WX1200 3CRWX120695A manual Configuring WPA

Configuring WPA 289

„Probe response (sent by a MAP radio) — The WPA IE in a probe response frame lists the same WPA information that is contained in the beacon frame.

„Association request or reassociation (sent by a client) — The WPA IE in an association request lists the authentication method and cipher suite the client wants to use.

Client Support To use the TKIP or CCMP cipher suite for encryption, a client must support WPA. However, a MAP radio configured for WPA can support non-WPA clients who use dynamic WEP or static WEP. If the WPA IE is enabled in the service profile used by an SSID supported by the radio, and the 40-bit WEP or 104-bit WEP cipher suite also is enabled in the service profile, MSS allows a non-WPA client to authenticate using WEP under the following circumstances:

„If a client wants to authenticate using dynamic WEP, MSS uses 802.1X to authenticate the client if either the WEP40 or WEP104 cipher suite is enabled for WPA.

„If a client wants to authenticate using static WEP, the radio checks for the static WEP key presented by the client. If the keys match, MSS authenticates the client. Because the WEP key is static, MSS does not use 802.1X to authenticate the client.

To allow a non-WPA client that uses dynamic WEP to be authenticated by a radio on which WPA IE is enabled, enable the WEP40 or WEP104 cipher suite in the service profile for the SSID the client will access. To prevent non-WPA clients that use dynamic WEP from being authenticated, do not enable the WEP40 or WEP104 cipher suite in the service profile.

To allow a client that uses static WEP to be authenticated, configure the same WEP keys on the client and the service profile.